39

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22?

The output of iptables -L -v -n:

 Chain fail2ban-ssh (1 references)
 pkts bytes target     prot opt in     out     source               destination                                                                                         
    0     0 DROP       all  --  *      *       119.235.2.158        0.0.0.0/0                                                                                           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                           

 Chain fail2ban-ssh-ddos (0 references)
 pkts bytes target     prot opt in     out     source               destination

The output of service iptables status :

iptables: unrecognized service

Summery of fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf:

Summary
=======

Addresses found:
[1]
[2]
[3]
    113.59.222.240 (Wed Mar 21 18:24:47 2012)
    113.59.222.240 (Wed Mar 21 18:24:52 2012)
    119.235.14.153 (Wed Mar 21 21:52:53 2012)
    113.59.222.21 (Thu Mar 22 07:50:44 2012)
    176.9.57.203 (Fri Mar 23 19:34:29 2012)
    176.9.57.203 (Fri Mar 23 19:34:42 2012)
    113.59.222.56 (Sat Mar 31 14:23:52 2012)
    113.59.222.56 (Sat Mar 31 14:24:05 2012)
    119.235.14.183 (Mon Apr 02 20:49:13 2012)
    119.235.14.168 (Sat Apr 21 09:58:56 2012)
    119.235.2.158 (Wed Apr 25 13:11:03 2012)
    119.235.2.158 (Wed Apr 25 13:11:40 2012)
    119.235.2.158 (Wed Apr 25 13:11:43 2012)
    119.235.2.158 (Wed Apr 25 13:11:47 2012)
    119.235.2.158 (Wed Apr 25 13:12:49 2012)
    119.235.2.158 (Wed Apr 25 13:12:52 2012)
    119.235.2.158 (Wed Apr 25 13:12:55 2012)
    119.235.2.158 (Wed Apr 25 13:12:58 2012)
    119.235.2.158 (Wed Apr 25 13:13:02 2012)
    119.235.2.158 (Wed Apr 25 13:13:04 2012)
    119.235.2.158 (Wed Apr 25 13:13:25 2012)
    119.235.2.158 (Wed Apr 25 13:19:18 2012)
    119.235.2.158 (Wed Apr 25 13:19:52 2012)
    119.235.2.158 (Wed Apr 25 13:19:55 2012)
    119.235.2.158 (Wed Apr 25 13:19:55 2012)
    119.235.2.158 (Wed Apr 25 13:19:58 2012)
    119.235.2.158 (Wed Apr 25 13:20:02 2012)
    119.235.2.158 (Wed Apr 25 13:20:05 2012)
    119.235.2.158 (Wed Apr 25 13:40:16 2012)
[4]
[5]
    119.235.2.158 (Wed Apr 25 13:11:38 2012)
    119.235.2.158 (Wed Apr 25 13:12:46 2012)
    119.235.2.158 (Wed Apr 25 13:19:49 2012)
[6]
    119.235.2.155 (Wed Mar 21 13:13:30 2012)
    113.59.222.240 (Wed Mar 21 18:24:43 2012)
    119.235.14.153 (Wed Mar 21 21:52:51 2012)
    176.9.57.203 (Fri Mar 23 19:34:26 2012)
    119.235.2.158 (Wed Apr 25 13:19:15 2012)
[7]
[8]
[9]
[10]

Date template hits:
1169837 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>

Success, the total number of match is 37

However, look at the above section 'Running tests' which could contain important
information.

The jail.conf:

    # Fail2Ban configuration file.
#
# This file was composed for Debian systems from the original one
#  provided now under /usr/share/doc/fail2ban/examples/jail.conf
#  for additional examples.
#
# To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local
#
# Author: Yaroslav O. Halchenko <[email protected]>
#
# $Revision: 281 $
#

# The DEFAULT allows a global definition of the options. They can be override
# in each jail afterwards.

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1
bantime  = 14400
maxretry = 3

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#      This issue left ToDo, so polling is default backend for now
backend = polling

#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

#
# ACTIONS
#

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define 
# action_* variables. Can be overriden globally or per 
# section within jail.local file
banaction = iptables-multiport

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail

# Default protocol
protocol = tcp

#
# Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
              %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s]

# Choose default action.  To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section 
action = %(action_)s

#
# JAILS
#

# Next jails corresponds to the standard configuration in Fail2ban 0.6 which
# was shipped in Debian. Enable any defined here jail by including
#
# [SECTION_NAME] 
# enabled = true

#
# in /etc/fail2ban/jail.local.
#
# Optionally you may override any other parameter (e.g. banaction,
# action, port, logpath, etc) in that section within jail.local

[ssh]

enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 4

# Generic filter for pam. Has to be used with action which bans all ports
# such as iptables-allports, shorewall
[pam-generic]

enabled = false
# pam-generic filter can be customized to monitor specific subset of 'tty's
filter  = pam-generic
# port actually must be irrelevant but lets leave it all for some possible uses
port = all
banaction = iptables-allports
port     = anyport
logpath  = /var/log/auth.log
maxretry = 6

[xinetd-fail]

enabled   = false
filter    = xinetd-fail
port      = all
banaction = iptables-multiport-log
logpath   = /var/log/daemon.log
maxretry  = 2


[ssh-ddos]

enabled = true
port    = ssh
filter  = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 6

#
# HTTP servers
#

[apache]

enabled = false
port    = http,https
filter  = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 6

# default action is now multiport, so apache-multiport jail was left
# for compatibility with previous (<0.7.6-2) releases
[apache-multiport]

enabled   = false
port      = http,https
filter    = apache-auth
logpath   = /var/log/apache*/*error.log
maxretry  = 6

[apache-noscript]

enabled = false
port    = http,https
filter  = apache-noscript
logpath = /var/log/apache*/*error.log
maxretry = 6

[apache-overflows]

enabled = false
port    = http,https
filter  = apache-overflows
logpath = /var/log/apache*/*error.log
maxretry = 2

 [nginx-auth]
 enabled = true
 filter = nginx-auth
 action = iptables-multiport[name=NoAuthFailures, port="http,https"]
 logpath = /var/log/nginx*/*error*.log
 bantime = 600 # 10 minutes
 maxretry = 6

 [nginx-login]
 enabled = true
 filter = nginx-login
 action = iptables-multiport[name=NoLoginFailures, port="http,https"]
 logpath = /var/log/nginx*/*access*.log
 bantime = 600 # 10 minutes
 maxretry = 6

 [nginx-badbots]
 enabled  = true
 filter = apache-badbots
 action = iptables-multiport[name=BadBots, port="http,https"]
 logpath = /var/log/nginx*/*access*.log
 bantime = 86400 # 1 day
 maxretry = 1

 [nginx-noscript]
 enabled = true
 action = iptables-multiport[name=NoScript, port="http,https"]
 filter = nginx-noscript
 logpath = /var/log/nginx*/*access*.log
 maxretry = 6
 bantime  = 86400 # 1 day

 [nginx-proxy]
 enabled = true
 action = iptables-multiport[name=NoProxy, port="http,https"]
 filter = nginx-proxy
 logpath = /var/log/nginx*/*access*.log
 maxretry = 0
 bantime  = 86400 # 1 day


#
# FTP servers
#

[vsftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = vsftpd
logpath  = /var/log/vsftpd.log
# or overwrite it in jails.local to be
# logpath = /var/log/auth.log
# if you want to rely on PAM failed login attempts
# vsftpd's failregex should match both of those formats
maxretry = 6


[proftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = proftpd
logpath  = /var/log/proftpd/proftpd.log
maxretry = 6


[wuftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = wuftpd
logpath  = /var/log/auth.log
maxretry = 6


#
# Mail servers
#

[postfix]

enabled  = false
port     = smtp,ssmtp
filter   = postfix
logpath  = /var/log/mail.log


[couriersmtp]

enabled  = false
port     = smtp,ssmtp
filter   = couriersmtp
logpath  = /var/log/mail.log


#
# Mail servers authenticators: might be used for smtp,ftp,imap servers, so
# all relevant ports get banned
#

[courierauth]

enabled  = false
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = courierlogin
logpath  = /var/log/mail.log


[sasl]

enabled  = false
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = sasl
# You might consider monitoring /var/log/warn.log instead
# if you are running postfix. See http://bugs.debian.org/507990
logpath  = /var/log/mail.log


# DNS Servers


# These jails block attacks against named (bind9). By default, logging is off
# with bind9 installation. You will need something like this:
#
# logging {
#     channel security_file {
#         file "/var/log/named/security.log" versions 3 size 30m;
#         severity dynamic;
#         print-time yes;
#     };
#     category security {
#         security_file;
#     };
# };
#
# in your named.conf to provide proper logging

# !!! WARNING !!!
#   Since UDP is connectionless protocol, spoofing of IP and immitation
#   of illegal actions is way too simple.  Thus enabling of this filter
#   might provide an easy way for implementing a DoS against a chosen
#   victim. See
#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
#   Please DO NOT USE this jail unless you know what you are doing.
#[named-refused-udp]
#
#enabled  = false
#port     = domain,953
#protocol = udp
#filter   = named-refused
#logpath  = /var/log/named/security.log

[named-refused-tcp]

enabled  = false
port     = domain,953
protocol = tcp
filter   = named-refused
logpath  = /var/log/named/security.log

I just noticed an error in the fail2ban log:

2012-04-25 14:57:29,359 fail2ban.actions.action: ERROR iptables -N fail2ban-ssh-ddos

9
  • OS? CentOS/Ubuntu/...? Output for /etc/init.d/iptables status Apr 25, 2012 at 8:13
  • @BartDeVos OS Ubuntu 11.04... "/etc/init.d/iptables status" = bash: /etc/init.d/iptables: No such file or directory... Note : I use APF to manage iptables!
    – THpubs
    Apr 25, 2012 at 8:21
  • Well, there is probably your problem. How about disabling apf, set up a basic firewall with iptables and see if the problem persist? Apr 25, 2012 at 8:34
  • @BartDeVos Thats the problem... Im in a VPS system... I think its openvz... So, some firewalls like UFW won't work here!
    – THpubs
    Apr 25, 2012 at 8:37
  • Can you run ufw enable? Apr 25, 2012 at 8:39

5 Answers 5

32

Fail2Ban uses the file /etc/fail2ban/jail.localand look for the [ssh]section, you can change the port there.

[ssh]
enabled  = true
port     = ssh

You can change the port value to any positive integer.

If it's not working and you want to look further, take a look at /etc/fail2ban/jail.conf, there should be something like:

 logpath = /var/log/auth.log

That is what fail2ban uses to detect false logins.

If it is not working correctly, you can try a few things to pinpoint the problem. Start by checking if it is installed:

dpkg -l |grep fail   

Check if the service is running:

/etc/init.d/fail2ban status 

Check if your SSH-jail is setup:

sudo fail2ban-client status  

Check the log file:

fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

Check your date/time:

date && tail -2 /var/log/auth.log

(You should first get the date, followed by the last lines in auth.log. If you still can't pinpoint the error, add your configuration file to your post.

7
  • It doesn't seems to be working... Not blocking my failed logins!
    – THpubs
    Apr 25, 2012 at 7:50
  • 1
    The logs show that my IP is blocked... But I can still login!
    – THpubs
    Apr 25, 2012 at 8:00
  • What is the output for iptables -L -v -n and/or service iptables status Apr 25, 2012 at 8:05
  • I added the outputs to the question... please check it...
    – THpubs
    Apr 25, 2012 at 8:09
  • 10
    This answer is misleading. Although, fail2ban doesn't care about the ssh port for detection, it will only block the standard (ie wrong) port (22) so the malicious user can still continue to connect to the non standard port. This answer has details about changing the blocked port.
    – robd
    Mar 26, 2015 at 18:19
46

fail2ban will detect login attemps with log content. fail2ban don't use ports for detection, only to block.
To block the right port, you have to tell fail2ban which one in order to correctly setup iptable.
Into /etc/fail2ban/jail.local:

[ssh]
enabled  = true
port     = ssh   <-- just modify this with your port    port = 1234

Another method is to block everything from the offending hosts. So iptable will drop every paquets from them, not only ssh ones.
At the beginning of /etc/fail2ban/jail.local:

banaction = iptables-multiport     <-- regular blocking (one or several ports)
banaction = iptables-allports      <-- block everything

With iptables-allports you don't have to bother about ports. Just leave the default ones.

5
  • Great... it works for some extent.. But I just noticed an error in the fail2ban log : "2012-04-25 14:57:29,359 fail2ban.actions.action: ERROR iptables -N fail2ban-ssh-ddos" also it won't block me if I fail to login... It will block me only if I do it really fast. If I wait till SSH to say the password is wrong, it won't block me!
    – THpubs
    Apr 25, 2012 at 9:36
  • 2
    I'm afraid you have to read the doc. Fail2ban have parameters to tune the number of attempts before being blocked. Apr 25, 2012 at 16:01
  • @THpubs try setting findtime = 1h and it will block you without doing it really fast.
    – Pathros
    Nov 11, 2020 at 23:43
  • Do you have any idea why iptables is not updating the port after the customization in jail.local?
    – Tobia
    Mar 14, 2021 at 9:55
  • What if one removes the port = ssh altogether and instead relies on the global port = 0:65535 that is present at the top of the configuration file?
    – psq
    Feb 15, 2023 at 19:34
13

In short : if you changed the ssh port number you have to add it in the jail.local file

For example : (I use SSH, SFTP on the port 1234)

in jail.local :

[ssh]

enabled  = true

port     = ssh,sftp,1234

filter   = sshd

logpath  = /var/log/auth.log

maxretry = 6
1
  • 1
    Thanks , worked like expected, only needed to modify the logpath to /var/log/secure
    – user138870
    Jun 21, 2015 at 11:20
10

I know this is an old thread but this is what pops up on a google search for this subject. I didn't see anyone give the most correct answer (imo) so here it is.

To change the Linux named port definition globally go to /etc/services

ssh             22/tcp
ssh             22/udp

There is no need to change anything in the fail2ban configuration or in any other application that uses Linux named ports.

0

I know that this is not strictly answering the question, but anyway...

As another way of solving the problem, you could consider keeping standard ports in your server configuration, and then doing the NAT in your router.

For instance, in my setup I also do not use standard port for ssh from the outside, but my server configuration is standard for ssh (as well as it is for ftp, vpn etc) I just open non-standard ports in the router and have them forwarded to standard port.

This way of doing it saves me quite a lot of time when configuring my setup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .